This site currently shows sample data for demonstration.
BDVDB
বাংলা

Vulnerabilities

CVE-2026-31842 | BDVDB-2026-325281 Detail

Tinyproxy ProjectTinyproxy

Description#

Tinyproxy through 1.11.3 is vulnerable to HTTP request parsing desynchronization due to a case-sensitive comparison of the Transfer-Encoding header in src/reqs.c. The is_chunked_transfer function uses strcmp to compare the header value against "chunked", even though RFC 7230 specifies that transfer-coding names are case-insensitive.

Impact#

An unauthenticated remote attacker can trigger HTTP request parsing desynchronization using a mixed-case Transfer-Encoding header (e.g., 'Chunked'), leading to backend connection hangs and denial of service. In certain deployments, request-body inspection and filtering mechanisms relying on Tinyproxy may also be bypassed.

Weaknesses#

  • CWE-444 Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

References#

Exploit#

No public exploit known

History#

  1. Version 1Record published in the CVE List.
  2. Version 2Most recent update recorded in the CVE List.